cesnimda
4.1 KiB
Dependency advisory refresh and bounded remediation — 24 October 2026
The live NuGet and npm audits were refreshed against the actual locked graph. Original failing
results remain under .artifacts/p9-requal-01/security-before-pins/; successor results are under
.artifacts/p9-requal-01/security/. These are package-presence findings, not a reproduced exploit
or proof of application reachability. No production package, service or image was changed.
| Finding | Before | Minimal correction | Successor |
|---|---|---|---|
| P9-REQUAL-SEC01 | MimeKit4.17.0 resolves Pkcs8.0.1; high and moderate denial-of-service advisories | Direct Pkcs8.0.2 security floor, preserving supported8.x API; refresh API and both test-project locks | Live API NuGet graph reports no vulnerable packages |
| P9-REQUAL-SEC02 | Next16.3.8 matches critical/high advisories | Pin Next and matching ESLint config16.4.1; matching Next compiler/environment packages change together | Live npm policy passes, zero reported vulnerabilities |
| P9-REQUAL-SEC03 | Dev-only ESLint hooks chain resolves Zod4.5.4 | Override4.6.6, within existing compatible4.x range | Live npm policy passes; no exception bypass |
| P9-REQUAL-SEC04 | Sidecar Linux hash lock contains reported advisories across eight packages, including upload parsers and ML dependencies | No broad parser/ML transition attempted; separately validated remediation required | OPEN; exact-pin advisory coverage also INCOMPLETE |
The additional Python review queries all49 exact Linux lock pins. Its
machine-readable evidence records98 queries,97 successful responses and
one PyPI404 for the vendor-local torch==2.6.0+cpu release; the exact OSV query succeeds. The249
provider records group into109 sets of published aliases across eight packages. These are not109
independent CVEs or reproduced exploits. Published records include critical/high labels. The
untrusted-upload path reaches the PDF/image libraries; existing limits do not close these findings.
Major parser/ML compatibility, model integrity and complete release validation are separate work.
The sidecar source, hash lock and configured model remain unchanged. Overall security is OPEN.
The current static export does not run the Next server's image optimizer, Server Actions or
use cache. Existing Sharp0.35.5 also satisfies the published image-optimizer workaround. Those
facts bound exposure; they do not erase the package advisory or justify keeping a vulnerable
development-server dependency. No hostile denial-of-service or RCE payload was executed.
Primary advisory records:
- Pkcs signature verification CPU exhaustion and Windows envelope decoding:8.0.2 is patched.
- Next image optimization, Server Actions and typed-array cache result.
- Zod collection validation:4.6.6 is patched.
No unrelated package versions changed. Installation used the existing lock with lifecycle scripts disabled; production static build, full types/lint, backend1,123/1,123, frontend934/934 in105 suites and MariaDB32/32 pass after the pins. Complete browser/PDF successors and the final source/report manifest remain separately accounted in the final validation ledger. Earlier pre-pin passing runs are retained as superseded evidence rather than added to these totals.
Existing offline supply-chain/evaluator/browser-runtime/ingress/SMTP/dependency-policy/extension guards pass. Tracked-secret scanning and SBOM generation pass. Those checks are narrower than an application security certification or a clean Python advisory gate. The inherited temporary dev-advisory policy expires on 1November2026UTC; it was neither broadened nor extended, and the current npm audit uses no exception. Production still requires independent ingress, deployed identity, storage/recovery, provider, monitoring and human release qualifications.